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Background 


Utah statute authorizes a peace officer (officer) to take possession of evidence and other property 
through various means, including seizing property related to a crime or public safety,^ receiving 
firearms for safekeeping,^ and finding or receiving lost or mislaid property.^ Examples of property 
taken into custody include money, weapons, controlled substances, drug paraphernalia, motor 
vehicles, bicycles, jewelry, clothing, biological evidence, and phones. 

Property owners, prosecutors, and other interested parties expect a law enforcement agency 
(agency) to take measures that provide reasonable assurance that property in the possession of 
the agency is secured, tracked, and maintained. Additionally, state statute requires agencies to 
hold seized property "in safe custody" and maintain "a detailed inventory of all property seized."^ 
Securing, tracking, and maintaining property ensures the integrity of property held as evidence 
and enables the safe return of property to owners. 

To provide reasonable assurance that property is kept safe, an agency should establish 
appropriate management controls and procedures. For example, state statute requires an agency 
to provide a receipt to a person from whom the officer seizes property.^ The receipt provides a 
record, for both the property owner and the agency, of what property the officer seized. When 
the agency no longer needs the property, the receipt facilitates the return of the property to the 
owner. Other controls and procedures might address the process for recording and inventorying 
property, security measures such as access to property and surveillance requirements, and 
disposing of property. Failure to provide adequate management controls and procedures can lead 
to lost, stolen, or compromised property as well as a loss of public trust. 

For the purpose of this report, "property" refers to all items an officer assumes possession of, 
including but not limited to, found property, items retained for safekeeping, items seized for 
evidentiary or forfeiture purposes, or contraband. 

The objective of this review was to determine to what extent agencies have established 
appropriate controls over property, including evidence, with particular emphasis on money,® 
firearms, and controlled substances.^ We reviewed seven agencies (See Figure 1), checking each 


1 See Utah Code §24-2-102. 

^ See Utah Code § 53-5c-201. 

^ See Utah Code Title 77, Chapter 24a, Lost or Mislaid Personal Property. 

See Utah Code § 24-2-103(2). 

= See Utah Code § 24-2-103(1). 

® For purposes of this review, money includes all of the cash, coinage, and checks possessed by the property function 
of an agency. 

For purposes of this review, a controlled substance means a substance that is unlawful to produce or to possess 
under state or federal law. 
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agency's controls, policies, and procedures for compliance with applicable state statutes and 
application of industry best practices.® 


Figure 1_Law Enforcement Agency Statistics 


Agency 

Population of 
Jurisdiction 

Agency 

Budget 

Number of 
Property 

Items 

Full-Time 

Police 

Officers 

Full-Time 

Property 

Technicians 

Part-Time 

Property 

Technicians 

A 

60,000 to 90,000 

$1,000,000 to 
$5,000,000 

2,000 to 6,500 

10 to 20 

0 

1 

B 

0 to 30,000 

$1,000,000 to 
$5,000,000 

2,000 to 6,500 

10 to 20 

0 

1 

C 

60,000 to 90,000 

$20,000,000 to 
$25,000,000 

Greater than 
40,000 

Greater than 

100 

2 

0 

D 

0 to 30,000 

$5,000,000 to 
$10,000,000 

2,000 to 6,500 

20 to 30 

0 

5 

E 

30,000 to 60,000 

$5,000,000 to 
$10,000,000 

2,000 to 6,500 

30 to 40 

1 

0 

F 

30,000 to 60,000 

$5,000,000 to 
$10,000,000 

2,000 to 6,500 

30 to 40 

0 

2 

G 

Greater than 

90,000 

$20,000,000 to 
$25,000,000 

Greater than 
40,000 

Greater than 

100 

6 

0 


^To determine applicable best practices, auditors reviewed industry standards, recommendations, and procedures 
from, among other entities, the International Association for Property and Evidence (lAPE); the Commission on 
Accreditation for Law Enforcement Agencies, Inc. (CALEA); and other states. We primarily rely on standards from the 
lAPE, which "is a non-profit organization created by and for law enforcement professionals to help establish 
recommended standards for all property and evidence departments" (see home.iape.org/about-us/about-us.html). 
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Finding 1 


Some Property Records Did Not Match 
Actual Property Storage 


Agencies should adequately maintain inventory records that track and record each item from 
receipt to disposal.® In comparing property records with property actually on hand, we discovered 
the following discrepancies: 

• Missing items; 

• Misplaced items; 

• Items marked as destroyed but still in inventory; and 

• Items destroyed but shown in inventory. 

Inaccurate inventory records not only erode public trust but also may diminish the ability to 
prosecute past, current, or future cases. For example, failure to keep accurate records could lead 
to property being unavailable for legal proceedings, potentially forcing the court to dismiss the 
case. Additionally, money, firearms, and controlled substances could be lost, stolen, or misused, 
which could pose a danger to the public's safety. Agencies should tighten their policies and 
procedures for property handling from the point of taking possession of an item to its final 
disposition. 

Agencies Have Not Safeguarded All Property in Their Possession 

Agencies have the responsibility to safeguard seized property and document an item's chain of 
custody.^® To do this, agencies should implement controls and processes that ensure property 
technicians properly record and track property.^^ An agency's ability to locate property in a timely 
manner is critical to operating an efficient and effective property room. For example, accurate 
inventory records facilitate providing evidence for court proceedings in a timely manner or 
returning property to the rightful owner. 

We found that sampled agencies did not adequately safeguard all of the property in their custody. 
Figure 2 shows the categories where the inventory records did not match the actual inventory on 
the shelves; specifically we looked at money, firearms, and controlled substances at each agency. 


® lAPE Standard 4.1: Documentation - Property Report 
“ Utah Code 24-2-103(l)(a) 

Utah Code 24-2-103(2) 

1^ lAPE Standard 4.1: Documentation - Property Report 


Office of the State Auditor 


Page I 3 







Figure 2 


Missing and Misplaced Money, Firearms, Controlled Substances, and Drug 
Paraphernalia byAgency^^ 


Agency 

Inconsistent Categories 

A 

B 

C 

D 

E 

F 

G 

Missing items 

55 

2 

10 

66 

0 

0 

6 

Misplaced items 

40 

28 

50 

51 

5 

3 

21 

Items marked destroyed but still in inventory 

5 

5 

10 

1 

7 

0 

0 

Items destroyed but shown in inventory 

12 

10 

97 

23 

8 

18 

3 

Total 

112 

45 

167 

141 

20 

21 

30 


Missing Items 

Missing items are items for which an agency could not find or adequately account for its 
disposition. Items determined to be missing included drug paraphernalia, marijuana, heroin, pills, 
mushrooms, cocaine, methamphetamines, money, and a firearm. Agency officials surmised that 
some of the missing items may have been destroyed, disposed, transferred to other agencies, or 
returned to owners without appropriate supporting documentation. Given the lack of inventory 
records and documentation of inventory disposition, we were unable to determine if items were 
missing due to poor recordkeeping, theft, or some other reason. Figure 3 shows a breakdown of 
missing items by agency. 

Figure 3 Missing Items 


Agency 

Money 

Controlled Drug 

Firearms ^ ^ 

Substances Paraphernalia 

Total 

A 

3 

0 

36 

16 

55 

B 

0 

0 

1 

1 

2 

C 

0 

1 

9 

0 

10 

D 

0 

0 

29 

37 

66 

E 

0 

0 

0 

0 

0 

F 

0 

0 

0 

0 

0 

G 

0 

0 

3 

3 

6 


Misplaced Items 

A misplaced item is an item that property technicians eventually located but was missing from the 
location indicated on the inventory record. We found that all sampled agencies had misplaced 


As shown in Figure 1, agencies A, B, D, E, and F have between 2,000 and 6,000 total property items while agencies C 
and G have more than 40,000 total property items. Due to limitations of agencies' record management systems, the 
majority of agencies could not provide the total number of items classified as controlled substances, money, or 
firearms. 
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items. In the course of our review, we also identified items that agencies mislabeled with an 
incorrect barcode or case number. We identified human error and weak policies and procedures 
as a major cause of items being mislabeled or misplaced. The number of mistakes increased in 
agencies with part-time or collateral assignment technicians.^'^ 

Items Marked with an Incorrect Disposition 

We identified several items in the agencies' possession that had been incorrectly marked in their 
databases as destroyed, purged, or released. This situation is of particular concern because items 
improperly marked as destroyed or released could be easy targets for misuse or pilferage. 
Assigning a second person to verify the items to be properly released or destroyed can mitigate 
this issue. Items should not be documented as destroyed until the actual destruction has 
occurred. 

We also found several items listed on the current inventory list that had been destroyed, 
converted to agency use, or released to the owner (See Figure 4). 


Figure 4_Incorrect Disposition 


Items marked destroyed but still in inventory Items were disposed of but still shown in inventory 


Ammunition, black bottle with an unknown liquid, 
drug paraphernalia, knives, marijuana, 
methamphetamine, money, pills, a powder 
substance, rifle, and revolver. 


Ammunition, cocaine, drug paraphernalia. Clock 
magazine, handguns, heroin, jewelry, marijuana, 
marijuana plants, methamphetamine, money, pills, 
rifles, and shotguns. 


Recommendations 

We recommend that agencies: 

1. Implement policies and procedures that are specific and detailed for handling property, 
from taking possession of an item through its final disposition. 

2. Be able to provide documentation and verification of every step in the destruction 
process. 

3. Ensure staff have sufficient resources to adequately manage property. 


A collateral assignment is when an agency employee with a full-time assignment (e.g. detective, dispatch, etc.) is 
given another duty, such as maintaining the property and property room, in addition to their full-time work. 
lAPE Standard 9.7: Drugs - Destruction Documentation 
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Law Enforcement Agencies Had 
Finding 2 Inadequate Controls Over Property 

Storage 


Agencies should implement management controls to provide reasonable assurance regarding the 
security and integrity of facilities used to store property.^® In our review of seven agencies, we 
found weak controls and, in some cases, a lack of controls over property storage (See Figure 5). 
Specifically, we found that some sampled agencies failed to: 

• Perform regular inventories; 

• Control or document access to property rooms; and 

• Implement sufficient security measures such as cameras and alarms. 

These issues were recurrent throughout multiple agencies and result in an increased risk that 
property could be lost, stolen, or tampered with. 


Figure 5_Controls for Property Storage Rooms by Agency 



Previous Full 

Access 

Log 

Unauthorized 


Alarm 

Agency 

Inventory 

Completed 

Individuals^^ 
Have Access 

Method of Entry 

and 

Surveillance 

A 

Yes 

Yes 

No 

Hard key and biometrics 

Camera only 

B 

Partial only 

No 

Yes 

Hard key or personnel card 

Camera only 

C 

No 

No 

Yes 

Hard key or key pad 

Camera and alarm 

D 

Partial only 

Yes 

No 

Personnel card 

None 

E 

Partial only 

Yes 

No 

Hard key and personnel card 

Camera only 

F 

Yes 

No 

No 

Hard key and personnel card 

Camera only 

G 

Partial only 

Yes 

No 

Hard key, personnel card, and 
biometrics 

Camera only 


Failure to Conduct Regular Inventories and Annual Audits 

According to the International Association for Property and Evidence (lAPE), agencies that 
conduct regular inventories are far less likely to experience an internal loss of property or 
evidence.A comprehensive audit, including a review of policies and procedures, of the property 
and evidence function is an important internal control that agencies should conduct at least 


lAPE Standard 8.1: Security - Policy 

An unauthorized individual is anyone who can access the property room without the aid of a property technician or 
supervisor. 

lAPE Standard 15.1: Inventories 
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annually. Additionally, supervisors or unit commanders who oversee the property function should 
regularly inspect property rooms. 

Four of the sampled agencies had never conducted a complete inventory of their respective 
property rooms, although they had conducted limited inventories. Agencies E and G last 
inventoried their respective drug rooms five years ago. Agency D had an inventory of its money, 
firearms, controlled substances performed by a different agency in 2013. Agency B last performed 
an inventory spot check in January 2018, but had never conducted a complete audit of its 
property room. 

Agency C had never conducted an inventory, but was the only agency to have completed a 
comprehensive audit of agency procedures. Agency F's current custodians were unaware of when 
the last inventory or audit occurred, but are currently in the process of performing a complete 
inventory (See Figure 5). 

Access to Inventory Not Properly Controlled or Documented 

According to lAPE standards, agencies should closely control access to property storage areas to 
prevent alteration, unauthorized removal, or theft of property or evidence. Restricted access will 
also help agencies protect the proper chain of custody. Agencies should permit access to storage 
areas only by property technicians and their supervisors. When other people enter property 
facilities, the name of the person and reason for entry should be logged, and property technicians 
should provide an escort.lAPE standards recommend that supervisors review the access log on 
a regular basis, at least monthly, and should inspect logs as part of periodic inventory audits. 
Because missing property may not be readily discovered, agencies should maintain access logs for 
several years. 

Additionally, agencies should enforce multiple entrance requirements to secure the property 
room. Multiple entrance requirements are especially important when a hard key is used because 
hard keys do not create an audit trail.Agency G was exemplary in this area, requiring a hard key, 
personnel card, and biometric identification for access to the property room (See Figure 5). 

Regarding controls for entry to the property room, we found the following: 

• Three sampled agencies (B, C, and F) did not maintain access logs; 


lAPE Standard 15.2: Audits and Inspections 
lAPE Standard 8.1 and 8.2: Security - Policy, Access 
lAPE Standard 8.3: Security-Access Logs 

lAPE Standard 8.5: Security - Key Control/Electronic Access Control 


Office of the State Auditor 


Page I 7 




• At two sampled agencies (B and C), it is possible for individuals other than property 
technicians and supervisors to have unrestricted access to the property room;^^ 

• Three sampled agencies (B, C, and D) did not have multiple requirements to enter the 
property room (e.g. personnel card, biometric identification, hard key, etc.). 

Lack of Alarm or Surveillance Systems in Property Rooms 

An alarm system and surveillance cameras are critical to maintaining public confidence in law 
enforcement because these systems demonstrate that only authorized personnel are allowed in 
high-risk areas.Alarm and surveillance systems serve to further protect an agency and preserve 
the chain of custody. The lack thereof results in unauthorized individuals being able to access the 
property room undetected. lAPE recommends that surveillance systems have three to four years 
storage capacity.Several of the agencies we reviewed kept their footage for a year or less. 

Agency C was the only agency we reviewed that had an alarm system in its property room. All but 
one of the sampled agencies had cameras in their respective property rooms (See Figure 5). It is 
critical that property room cameras be able to record all individuals who enter the room, as well 
as the entire premises of the room itself. 

Recommendations 


We recommend that agencies: 

1. Perform an inventory annually, or whenever a change in key-holding personnel or 
executive officer is made. These inspections should be conducted by a person who does 
not have responsibilities within the property unit. 

2. Conduct regular inspections by the supervisor or unit commander. 

3. Require anyone that is not assigned to the property unit, to sign and date an access log. 

4. Ensure that each property room has an adequate video surveillance system, including 
perimeter alarms, motion sensors, and suitable storage capacity. 

5. Implement multiple entrance requirements, including at least one that provides an audit 
trail, in order to gain access to the property and property room. 


At both of these agencies, an individual only needs to have a hard key to gain access to the property room. 
Property technicians from both agencies told us that various individuals have a hard key that can open the property 
room. Furthermore, technicians did not know how many keys there were or who was in possession of the keys. 

2'* CA POST 3-4, 3-6, and lAPE 8.7, 8.9 
lAPE Standard 8.9: Security - Video Surveillance 
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Finding 3 


Insufficient Controls for Property 
Disposal 


Documentation regarding destruction of property should provide a transparent and verifiable 
audit trail through final disposal.^® Typically, disposing of property consists of the agency releasing 
the item to the owner, converting the item to government use, selling the item at auction, or 
destroying the item by taking it to a waste management facility.Before disposing of a particular 
piece of evidence, agencies should first receive authorization to destroy it from the prosecuting 
attorney.^® Agencies should document the disposal process and, for high-risk components of the 
process, require an independent witness. Additionally, adequate procedures should exist for 
disposing of money and returning found property to owners or finders. 

Sampled Agencies are Not Sufficiently Documenting the Disposal of 
Controlled Substances 

Because of the danger controlled substances pose to agency personnel and the public, it is 
important to provide reasonable assurance that controlled substances scheduled for destruction 
are actually destroyed.^® Key controls include documenting who is involved in the destruction 
process and requiring independent witnesses for high-risk components of the process.lAPE 
standards state that documentation should include the name of the person who: 

• Authorized the drug item for destruction; 

• Staged and verified the item on the destruction list (witness needed); 

• Sealed the item in a destruction container (witness needed); 

• Transported the destruction container to the destruction location (witness needed); and 

• Witnessed the physical destruction of the drugs. 

As shown in Figure 6, our review revealed that, of sampled agencies, only Agency G implements 
all five of the documentation standards listed above. 


lAPE Standard 4.1: Documentation - Property Report 

lAPE Standard 14.6: Disposition - Destruction; Utah Code § 24-3-103(1) 

Utah Code § 24-3-103(1) 

lAPE Standard 9.7: Drugs - Destruction Documentation 
lAPE Standard 9.7: Drugs - Destruction Documentation 
lAPE Standard 9.7: Drugs - Destruction Documentation 


Office of the State Auditor 


Page I 9 








Figure 6 


Controlled Substance Disposal Steps by Agency 


Agency 

Properly 
authorized the 
drug for 
destruction 

Verified item 
on destruction 
list 

Sealed the item 
in a destruction 

container 

Documented the 
transportation of the 
destruction container 
to destruction 
location 

Witnessed and 
documented the 
physical destruction 
of the drugs 

A 

- 

- 

- 

- 

- 

B 

X 

- 

X 

- 

- 

C 

X 

- 

- 

- 

- 

D 

X 

- 

- 

- 

- 

E 

X 

- 

- 

- 

- 

F 

X 

- 

X 

X 

- 

G 

X 

X 

X 

X 

X 


According to lAPE, controlled substances pending destruction have the greatest likelihood of 
being pilfered since the items are no longer needed for prosecution.^^ Controlled substances may 
be stolen directly from a property storage facility or during the destruction process such as when 
drugs are transported to a waste management facility. As a result, there is a need for a defined 
destruction procedure that provides for thorough documentation and verification and that 
provides reasonable assurance regarding the final disposition of the drugs. The documentation 
should remain on file according to the agency's normal report retention schedule. 

According to best practices, agencies should also randomly inspect drug packages for tampering 
and weight discrepancies prior to destruction.^^ We found that none of the sampled agencies 
routinely weigh drugs prior to destruction. Only one agency will periodically weigh random 
samplings of controlled substances bound for destruction. 

Some Agencies Fail to Properly Deposit Money as Required by Statute 

State statute requires an agency to deposit seized money "into a separate, restricted, interest- 
bearing account maintained by the agency." Although silent on the timing of deposits, the statute 
does state that agencies should make deposits "for the purpose of managing and protecting the 
property from commingling, loss, or devaluation."^^ We found that some sampled agencies are 
storing money in property rooms, delaying deposits for months or, in some cases, even years. 
Doing so unnecessarily increases the risk that money will be lost, stolen, or devalued. Risk is 


lAPE Standard 9.7: Drugs - Destruction Documentation 
lAPE Standard 9.7: Drugs - Destruction Documentation 
lAPE Standard 9.9: Drugs - Drugs for Destruction Audit 
Utah Code § 24-2-103(5)(a) 
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especially high for agencies that give an individual both the power to delete records in the 
inventory management system and to have unrestricted access to money. 

Utah Department of Public Safety's (DPS) policies and practices for depositing seized money offer 
greater protection. DPS policy states that officers must deposit seized money as soon as is 
practical. DPS property technicians told us that, in practice, DPS officers usually deposit seized 
money within 24 to 72 hours of seizing the money. Additionally, money that DPS receives for 
safekeeping is disposed of or deposited within 30 days. 

In our review, we found that Agency C had over $175,000 and Agency G had over $300,000 stored 
in their respective property rooms. Some of the money stored by these agencies had been on 
hand for 10 years or more. Also of concern. Agency C is the only agency that does not keep money 
in a locked safe. The agency stores money in five cardboard boxes marked "Safe" in a room that 
contains other property. 

Lack of Controls for Returning Found Property to Owner or Finder 

When property is found and turned over to an officer, the agency is required to provide the finder 
with a form in which the finder provides a statement attesting to the manner in which the finder 
came into possession of the property.^® A duplicate of this form should be provided to the finder 
as a receipt. 

When an individual finds property^^ and turns it over to an agency, the agency becomes 
responsible for attempting to locate the owner.If the owner does not claim the property in a 
timely manner, the agency is required to give the finder the opportunity to claim the property.^® 

We identified two incidents where firearms were found and turned over to officers. Both of the 
guns were reported stolen, and the owners were known to the agency. However, the agency 
destroyed both firearms instead of returning them to the owners or finders. 

When releasing property, an agency should properly authorize and document the release and 
require the owner or finder to provide personal identification and to identify the item being 
released.If the finder fails to claim the property, then the agency may apply the property to a 


Utah Code 77-24a-3 

Found Property is non-evidentiary property, which, after coming into the custody of an agency, has been 
determined to be lost or abandoned and is not known or suspected to be connected with any criminal offense (see 
Utah Code§77-24a-l(l)) 

Utah Code§77-24a-4(l) 

Utah Code § 77-24a-3 
Utah Code § 77-24a-4 
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public interest use, sell the property and use the proceeds for a public interest use, or destroy the 
property. 

In our review, we found that only one of the seven agencies returned unclaimed property to the 
finder. Generally, we observed that most found property is destroyed rather than returned to the 
finder when unclaimed. Additionally, most of the agencies sampled do not sell property at a 
public auction to generate revenue or convert it to a public interest use. 

Recommendations 


We recommend that agencies: 

1. Obtain proper documentation for the authorization of destruction and retain the 
documentation in accordance with the normal report retention schedule. 

2. Require a second, independent person to verify and account for each item on a 
destruction list, as well as inspect the item for any signs of tampering, prior to destruction. 

3. Establish sufficient controls and documentation policies to provide reasonable assurance 
that property, especially a controlled substance, is actually destroyed. 

4. Comply with state statute and implement policies and procedures for depositing seized 
money in an account as soon as is practical. 

5. Create a "Statement of Finder of Property" form to be provided to individuals who turn 
over found property to an officer or agency."^^ 

6. Comply with state statute with regard to managing and disposing of found property, 
specifically attempting to locate the owner, and notifying and returning unclaimed found 
property to the finder when the owner cannot be located. 


« Utah Code § 77-24a-5(3) 
See Utah Code 77-24a-3 
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Finding 4 


Law Enforcement Agencies are not Issuing 
Receipts to Owners of Seized Property as 
Required by State Statute 


When an agency seizes property, state statute requires an agency to issue a receipt and provide 
information regarding the forfeiture process to the person from whom the agency seized the 
property.The agency is required to include the following information on the receipt: 

• Property description; 

• Date of seizure; and 

• Contact information for the agency. 

We found that when the sampled agencies do not have a search warrant, the agencies do not 
issue receipts for seized property as required by state statute (See Figure 7). Conversely, when 
sampled agencies seize property in conjunction with a search warrant, these agencies correctly 
issued receipts. 

Figure 7 Receipt Issuance for Seized Property by Agency 


Agency 

Receipt Provided 
(No Search Warrant) 

Receipt Provided 
(Search Warrant) 

A 

No 

Yes 

B 

No 

Yes 

C 

No 

Yes 

D 

No 

Yes 

E 

Some officers provide a 
receipt but most do not 

Yes 

F 

No 

Yes 

G 

Some officers provide a 
receipt but most do not 

Yes 


A receipt is the beginning of the chain of custody for seized property. Failure to issue a receipt for 
seized property has the potential to facilitate misappropriation of the seized property and prevent 
agencies from properly returning property. Issuing receipts can also help protect agencies when 
property owners accuse agencies of seizing property that those agencies did not actually seize. 


See Utah Code § 24-2-103(l)(a) and (c). 
See Utah Code § 24-2-103(l)(b). 
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One likely cause of not issuing receipts is that none of the agencies had policies and procedures 
addressing the issuance of receipts to owners of seized property. 

Recommendations 

We recommend that agencies: 

1. Comply with state statute by issuing receipts to property owners every time an agency 
seizes property, regardless of the circumstances. 

2. Include a receipt policy consistent with state statute in the agency's policy and procedure 
manuals and ensure compliance with the policy. 
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Finding 5 


Inadequate Controls Regarding Access to 
Digital Property Records 


Law enforcement agencies keep digital records of property, including evidence, in their custody. 
Providing access to these records creates a risk that records will be modified or deleted. Agencies 
should therefore provide access only as necessary to accomplish essential agency responsibilities. 
Granting the same individual access to the digital records and the physical property increases the 
risk that records will be modified or that property will be stolen. Agencies should separate duties 
or implement mitigating controls to prevent any individual from unilaterally modifying the status 
of a digital property record and taking custody of the related physical property without timely 
detection. 

Terminated Law Enforcement Employees Retained User Accounts with 
Access to Digital Property Records 


Each agency we reviewed utilized Spillman Technologies Law Enforcement Records Management 
software (Spillman) to maintain digital records of all evidence and property in their custody. 
Spillman allows agencies to create individual user accounts for each employee with property 
management responsibilities and to customize the actions each user may take within the 
application. 

At six of the seven agencies reviewed, some terminated employees retained Spillman user 
accounts after their departure from the agency. Four of these accounts retained the ability to 
delete digital property records. The retention of active user accounts after employee termination 
creates an unnecessary risk of unauthorized access to digital property records. At each of the six 
agencies, a user can only login to Spillman after gaining access to the agency's local network, 
partially mitigating the risk of unauthorized access. However, at two sampled agencies, we found 
eight terminated employees with existing local network user accounts in addition to user 
accounts on the Spillman application. 

To protect property records from unauthorized access, agencies should create only Spillman user 
accounts for employees who require access to these records to accomplish their job 
requirements. Furthermore, when an agency employee is terminated or his job responsibilities 
change such that access to property records is no longer required, the agency should immediately 
deactivate that employee's user account. Finally, agencies should employ the principle of least 
privilege in determining user account permissions, providing each individual with the minimum 
access to property records required to accomplish the individual's job responsibilities. 
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Law Enforcement Agencies Have Not Implemented Separation of Duties 
Regarding the Custody and Recording of Property 


Best practices regarding the safeguarding of valuable assets require that custody of the asset and 
the recording of custody changes be performed by separate individuals. This separation of duties 
reduces the risk that assets will be stolen or otherwise compromised, as no single individual can 
take malicious action without detection. Agencies can implement separation of duties in the 
safeguarding of property by ensuring that no single individual may access physical property and 
modify digital records. 

Where resource constraints preclude separation of duties in this way, agencies may implement 
other controls to mitigate risk. For example, an agency may require that two individuals 
participate in the destruction of any property, after which requiring both individuals to sign off on 
a written record of the destruction. The agency could then periodically review these signatures, 
ensuring that unilateral disposition of property is detected in a timely manner. 

All seven agencies reviewed in this audit permitted individuals to access both physical property 
and digital records. This practice enables individuals to both modify the status of a property 
record in Spillman (e.g. mark the property as destroyed) and move the physical property without 
the cooperation of another employee. This access could allow a malicious actor to illegally 
confiscate property without detection. 

Providing custody and record-keeping responsibilities to a single individual is particularly 
concerning when the individual has the ability to delete a property record from the system rather 
than simply accessing or modifying it. In such a case, detection of malfeasance is even less likely, 
because an audit of physical property typically seeks to verify that assets in custody match 
existing digital records. 

Three of the sampled agencies gave certain individuals the ability to access physical property and 
to delete digital records. In one agency, we found evidence in the agency's custody for which the 
digital record had been deleted from the system. Had the evidence been inappropriately 
confiscated, it would almost certainly not have been detected. To ensure the security of property 
in police custody, agencies should separate duties or implement mitigating controls to prevent 
any individual from unilaterally modifying the status of a digital property record and taking 
custody of the related physical property without timely detection. 
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Figure 8 


Breakdown of Access Control Weaknesses by Agency 
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Recommendations 


We recommend that agencies: 

1. Implement controls to ensure that only active employees with a job-related need have 
access to digital property records. 

2. Rescind terminated employees' access to such records immediately upon termination. 

3. Implement controls to ensure that an individual may not unilaterally modify the status of a 
digital property record and take custody of the related physical property without timely 
detection. 


Non-employees includes terminated employees as well as individuals whose employment could not be confirmed 
by the agency. 

Network accounts for Agency A were not reviewed because Spillman users are not required to first authenticate to 
the agency's local network before accessing the application. 

Agencies B and C only require a hard key to enter the property rooms. Both agencies have multiple keys to which 
an unspecified number of individuals have access. 
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Appendix A 


Audit Objectives, Scope, Methodology, and 
Limitations 


The objective of this review was to determine to what extent agencies have established 
appropriate controls over property, including evidence, with particular emphasis on money, 
firearms, and controlled substances. From August 2018 to April 2019, we reviewed seven 
agencies, checking each agency's controls, policies, and procedures for compliance with 
applicable state statutes'^^ and application of industry best practices.'^® 

We selected agencies through a judgmental sample based on several factors, including agency 
size and population served. For each agency sampled, we performed a physical inventory to verify 
that property on record was actually on hand in the physical location assigned. For money, 
firearms, and controlled substances, the physical inventory included all items. We also 
judgmentally selected a sample of other items from the agencies' property lists. Other activities 
conducted during the audit include the following: 

• Reviewed state statutes, industry best practices, and similar audits performed in other 
states; 

• Toured facilities where agencies store and maintain property; 

• Interviewed agency personnel, including property technicians and supervisors; 

• Reviewed agency policy and procedure manuals; 

• Reviewed inventory records and matched records to the physical property;^” 

• Evaluated the accuracy and completeness of inventory records; 

• Reviewed documentation associated with chain of evidence, including documents related 
to the agency assuming custody of the property; the intake and storage of the property; 
the property being transferred, checked out, released, or destroyed; 

• Sampled and reviewed evidence associated with specific cases;^^ 


Applicable state statutes include Title 24, Forfeiture and Disposition of Property Act; Title 53, Chapter 5c, Firearms 
Safe Flarbor; and Title 77, Chapter 24a, Lost or Mislaid Personal Property. 

To determine applicable best practices, auditors reviewed industry standards, recommendations, and procedures 
from, among other entities, the International Association for Property and Evidence (lAPE); the Commission on 
Accreditation for Law Enforcement Agencies, Inc. (CALEA); and other states. We primarily relied on standards from 
the lAPE, which "is a non-profit organization created by and for law enforcement professionals to help establish 
recommended standards for all property and evidence departments" (see http://home.iape.org/about-us/about- 
us.html). 

We did not handle or verify the contents of the property packages. Property technicians presented packages to 
auditors. Property packages were stamped with an identification number (usually in barcode format), which auditors 
could compare to inventory records and content descriptions. Auditors also evaluated the seal integrity of the 
packages. 

The review of cases included evidence no longer held in storage. 
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• Sampled and reviewed incident reports prepared by officers to determine if the property 
noted on the incident report matched inventory records; and 

• Reviewed access controls to the property database, including users with administrative 
rights and ability to add, delete, and otherwise edit property records. 
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